---
typeId: req
recordId: benac-auth-003
fields:
  title: Local user authentication for sensitive actions
  statement: Each Host Station shall support a local user authentication or
    re-authentication mechanism for vault unlock and sensitive authority-bearing
    actions, including package trust, capability grants, secret use, private
    blob sharing, key wrapping, private data export, storage leases, compute
    leases, and plaintext disclosure approvals.
  rationale: Authority-bearing actions must reflect authenticated local intent
    rather than accidental UI state or agent request text.
  verification: Attempt sensitive actions before and after local user
    authentication and verify that unauthenticated attempts fail closed or
    remain pending approval.
  testable: true
  status: draft
  area: BENAC-AUTH
  sourceDocument: /home/johnb/Downloads/benac_syrs_v0_4_integrated_authentication.md
  sourceVersion: v0.4
  sourceSections:
    - 10.2 Authentication and authority boundaries
  order: 18
---
